.devcontainer/Dockerfile

-FROM containerbase/node:18.14.2@sha256:d3817b7251a8b3389d759394171e84c5afb7352f61d5ed5b12703977673a444c
+FROM ghcr.io/containerbase/node:18.16.1
 
 USER root
 
+RUN install-apt make g++
+
+# renovate: datasource=github-releases packageName=containerbase/python-prebuild
+RUN install-tool python 3.11.4
+
 # renovate: datasource=npm
 RUN install-tool yarn 1.22.19

.devcontainer/devcontainer.json

 {
+  "$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json",
   "hostRequirements": {
     "cpus": 4,
-    "memory": "8gb",
+    "memory": "7gb",
     "storage": "32gb"
   },
   "name": "Renovate",
   "dockerFile": "Dockerfile",
+  "customizations": {
+    "vscode": {
       "settings": {
-    "terminal.integrated.profiles.linux": { "bash": { "path": "/bin/bash" } },
+        "terminal.integrated.profiles.linux": {
+          "bash": { "path": "/bin/bash" }
+        },
         "terminal.integrated.defaultProfile.linux": "bash"
       },
       "extensions": [
         "dbaeumer.vscode-eslint",
         "esbenp.prettier-vscode",
         "orta.vscode-jest",
-    "EditorConfig.editorconfig"
-  ],
+        "editorconfig.editorconfig",
+        "github.vscode-github-actions"
+      ]
+    }
+  },
   "runArgs": [
     "--cap-add=SYS_PTRACE",
     "--security-opt",

.eslintrc.js

@@ -137,7 +137,7 @@ module.exports = {
       },
     ],
 
-    '@typescript-eslint/unbound-method': 2,
+    '@typescript-eslint/unbound-method': [2, { ignoreStatic: true }],
     '@typescript-eslint/ban-types': 2,
     '@renovate/jest-root-describe': 2,
 
@@ -208,6 +208,7 @@ module.exports = {
           'error',
           { devDependencies: true },
         ],
+        'no-console': 'off',
       },
     },
     {

.github/DISCUSSION_TEMPLATE/questions-answers.yml → .github/DISCUSSION_TEMPLATE/ask-a-question.yml

@@ -4,6 +4,7 @@ body:
     attributes:
       label: How are you running Renovate?
       options:
+        - 'Placeholder value, please select the correct response from the dropdown'
         - 'Mend Renovate hosted app on github.com'
         - 'Self-hosted'
     validations:
@@ -34,23 +35,6 @@ body:
     validations:
       required: false
 
-  - type: input
-    id: platform-version-if-selfhosting
-    attributes:
-      label: If you're self-hosting Renovate, tell us what version of the platform you run.
-      description: |
-        This field is for the version number of your _platform_, so one of these:
-          - AWS CodeCommit
-          - Azure DevOps
-          - Bitbucket Cloud
-          - Bitbucket Server
-          - Azure DevOps
-          - Gitea
-          - GitHub (.com and Enterprise Server)
-          - GitLab (.com and CE/EE)
-    validations:
-      required: false
-
   - type: dropdown
     id: regression-error
     attributes:

.github/DISCUSSION_TEMPLATE/ideas-general-discussion.yml

-body:
-  - type: dropdown
-    id: type-of-discussion
-    attributes:
-      label: Type of discussion.
-      description: Are you proposing an idea, or do you just want to chat?
-      options:
-        - I'm proposing an idea
-        - I just want to chat
-    validations:
-      required: true
-
-  - type: textarea
-    id: discussion-field
-    attributes:
-      label: Tell us more.
-      description: Explain your idea or chat away in this box.
-    validations:
-      required: true

.github/DISCUSSION_TEMPLATE/mend-renovate-app-support.yml

-body:
-  - type: checkboxes
-    id: hosted-app-checkbox
-    attributes:
-      label: I'm using the Mend Renovate hosted app.
-      description: Only use this discussion if you're using the Mend Renovate hosted app.
-      options:
-        - label: I'm using the Mend Renovate hosted app.
-          required: true
-
-  - type: dropdown
-    id: regression-error
-    attributes:
-      label: Was this something which used to work for you, and then stopped?
-      options:
-        - 'It used to work, and then stopped'
-        - 'I never saw this working'
-    validations:
-      required: true
-
-  - type: textarea
-    id: describe-problem
-    attributes:
-      label: Describe your problem.
-      description: 'Do not report any security concerns here. Email [renovate-disclosure@mend.io](mailto:renovate-disclosure@mend.io) instead.'
-    validations:
-      required: true
-
-  - type: textarea
-    id: debug-logs
-    attributes:
-      label: Relevant debug logs.
-      description: |
-        Log into [Renovate's app dashboard](https://app.renovatebot.com/dashboard) and locate the correct job log for when the problem occurred (e.g. when the PR was created).
-        Try to paste the *relevant* logs here, not the entire thing and not just a link to the dashboard (others don't have permissions to view them).
-        If you're not sure about the relevant parts of the log, then feel free to post the full log to a [Github Gist](https://gist.github.com/) and link to it.
-        Try to highlight the important logs into the issue itself.
-      value: |
-        <details><summary>Logs</summary>
-
-        ```
-        Copy/paste the relevant log(s) here, between the starting and ending backticks
-        ```
-
-        </details>
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/bug_report.yml → .github/DISCUSSION_TEMPLATE/report-a-problem.yml

-name: Bug report
-description: Confirmed bugs only. If in doubt, create a Discussion instead.
-labels: ['type:bug', 'status:requirements', 'priority-5-triage']
 body:
-  - type: markdown
-    attributes:
-      value: |
-        Before you begin to fill out the form, make sure you have actually found a bug.
-        If you're not sure then create a [discussion](https://github.com/renovatebot/renovate/discussions) first.
-        If you have questions or want help with Renovate, then also create a [discussion](https://github.com/renovatebot/renovate/discussions).
-
   - type: dropdown
     id: how-are-you-running-renovate
     attributes:
       label: How are you running Renovate?
       options:
+        - 'Placeholder value, please select the correct response from the dropdown'
         - 'Mend Renovate hosted app on github.com'
-        - 'Self-hosted'
+        - 'Self-hosted Renovate'
     validations:
       required: true
 
@@ -44,37 +35,21 @@ body:
     validations:
       required: false
 
-  - type: input
-    id: platform-version-if-selfhosting
-    attributes:
-      label: If you're self-hosting Renovate, tell us what version of the platform you run.
-      description: |
-        This field is for the version number of your _platform_, so one of these:
-          - AWS CodeCommit
-          - Azure DevOps
-          - Bitbucket Cloud
-          - Bitbucket Server
-          - Azure DevOps
-          - Gitea or Forgejo
-          - GitHub (.com and Enterprise Server)
-          - GitLab (.com and CE/EE)
-    validations:
-      required: false
-
   - type: dropdown
     id: regression-error
     attributes:
       label: Was this something which used to work for you, and then stopped?
       options:
+        - 'Placeholder value, please select the correct response from the dropdown'
+        - 'I am trying to get this working for the first time'
         - 'It used to work, and then stopped'
-        - 'I never saw this working'
     validations:
       required: true
 
   - type: textarea
-    id: describe-bug
+    id: describe-problem
     attributes:
-      label: Describe the bug
+      label: Describe the problem
       description: 'Do not report any security concerns here. Email [renovate-disclosure@mend.io](mailto:renovate-disclosure@mend.io) instead.'
     validations:
       required: true
@@ -84,12 +59,12 @@ body:
     attributes:
       label: Relevant debug logs
       description: |
-        Try not to raise a bug report unless you've looked at the logs first.
+        Try not to report a problem unless you've looked at the logs first.
         If you're running self-hosted, run with `LOG_LEVEL=debug` in your environment variables and search for whatever dependency/branch/PR that is causing the problem.
         If you are using the Renovate App, log into [Renovate's app dashboard](https://app.renovatebot.com/dashboard) and locate the correct job log for when the problem occurred (e.g. when the PR was created).
         Try to paste the *relevant* logs here, not the entire thing and not just a link to the dashboard (others don't have permissions to view them).
         If you're not sure about the relevant parts of the log, then feel free to post the full log to a [Github Gist](https://gist.github.com/) and link to it.
-        Try to highlight the important logs into the issue itself.
+        Try to highlight the important logs into the Discussion itself.
       value: |
         <details><summary>Logs</summary>
 
@@ -107,8 +82,8 @@ body:
       label: Have you created a minimal reproduction repository?
       description: Please read the [minimal reproductions documentation](https://github.com/renovatebot/renovate/blob/main/docs/development/minimal-reproductions.md) to learn how to make a good minimal reproduction repository.
       options:
-        - 'No reproduction repository'
-        - 'No reproduction, but I have linked to a public repo where it occurs'
-        - 'I have linked to a minimal reproduction repository in the bug description'
+        - 'Placeholder value, please select the correct response from the dropdown'
+        - 'I have linked to a minimal reproduction in the description above'
+        - 'I have explained in the description why a minimal reproduction is impossible'
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/request-a-feature.yml

+body:
+  - type: textarea
+    id: discussion-field
+    attributes:
+      label: Tell us more.
+      description: Explain your feature request in this field.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/administration-only.yml

+name: Administration only
+description: For administrators only
+labels: ['status:ready', 'priority-3-medium', 'needs-discussion']
+body:
+  - type: markdown
+    attributes:
+      value: '# This form is for Renovate administrators only.'
+
+  - type: markdown
+    attributes:
+      value: |
+        **Stop!** This form is for the Renovate administrators only.
+        If you're a user of Renovate, please create a GitHub Discussion.
+        Please go back a step and select _Start a discussion_ instead of Issue.
+
+  - type: textarea
+    id: describe-proposed-changes
+    attributes:
+      label: Describe the proposed change(s).
+      description: 'Do not report any security concerns here. Email renovate-disclosure@mend.io instead.'
+    validations:
+      required: true
+
+  - type: textarea
+    id: describe-why-we-need-want-these-changes
+    attributes:
+      label: Describe why we need/want these change(s).
+    validations:
+      required: true
+
+  - type: markdown
+    attributes:
+      value: '# Reminder for administrators:'
+
+  - type: markdown
+    attributes:
+      value: 'Before submitting the issue: add the correct **type:** label and remove the **needs-discussion** label.'

.github/ISSUE_TEMPLATE/config.yml

 blank_issues_enabled: false
 contact_links:
-  - name: Start a discussion (config, doubts, docs)
+  - name: Start a discussion
     url: https://github.com/renovatebot/renovate/discussions/new
-    about: If you have any questions about bot configuration or doubts about whether you should create a feature request or bug report, or have problems with the documentation please select the button to create a Discussion instead of an Issue.
+    about: Our preferred starting point if you have any questions or suggestions about bot configuration, features or behavior.

.github/ISSUE_TEMPLATE/feature_request.yml

-name: Feature request
-description: Suggest an idea for this project.
-labels: ['type:feature', 'status:requirements', 'priority-5-triage']
-body:
-  - type: textarea
-    id: what-would-you-like-renovate-to-be-able-to-do
-    attributes:
-      label: What would you like Renovate to be able to do?
-      description: Tell us what requirements you need solving, and be sure to mention too if this is part of any bigger problem you're trying to solve.
-    validations:
-      required: true
-
-  - type: textarea
-    id: implementation-idea-textbox
-    attributes:
-      label: If you have any ideas on how this should be implemented, please tell us here.
-      description: |
-        In case you've already dug into existing options or source code and have ideas, mention them here.
-        Try to keep implementation ideas separate from requirements.
-    validations:
-      required: true
-
-  - type: dropdown
-    id: interested-in-implementing-the-feature
-    attributes:
-      label: Is this a feature you are interested in implementing yourself?
-      options:
-        - 'No'
-        - 'Maybe'
-        - 'Yes'
-    validations:
-      required: true

.github/ISSUE_TEMPLATE/refactor.yml

-name: Refactor (internal)
-description: For internal use only.
-labels: ['type:refactor', 'status:requirements', 'priority-5-triage']
-body:
-  - type: markdown
-    attributes:
-      value: '# This form is for Renovate maintainers only.'
-
-  - type: textarea
-    id: describe-proposed-changes
-    attributes:
-      label: Describe the proposed change(s).
-      description: 'Do not report any security concerns here. Email renovate-disclosure@mend.io instead.'
-    validations:
-      required: true

.github/actions/calculate-prefetch-matrix/action.yml

+# This is the composite action:
+#   https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+#
+# Composite actions have some limitations:
+#   - many contexts are unavailable, e.g. `runner`
+#   - `env` can be specified per-step only
+#   - if `run` is used, `shell` must be explicitly specified
+name: 'Calculate matrix for `node_modules` prefetch'
+inputs:
+  repo:
+    description: 'Repository name'
+    required: true
+  token:
+    description: 'GitHub token'
+    required: true
+  node-version:
+    description: 'Node version'
+    required: true
+outputs:
+  matrix:
+    description: 'Matrix of OSes to prefetch `node_modules` for'
+    value: ${{ steps.os-matrix-prefetch.outputs.os-matrix-prefetch }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Calculate cache keys
+      id: cache-keys
+      env:
+        HASH: ${{ hashFiles('yarn.lock') }}
+      shell: bash
+      run: |
+        echo 'MACOS_KEY=node_modules-macOS-${{ inputs.node-version }}-${{ env.HASH }}' >> "$GITHUB_ENV"
+        echo 'WINDOWS_KEY=node_modules-Windows-${{ inputs.node-version }}-${{ env.HASH }}' >> "$GITHUB_ENV"
+
+    - name: Check cache miss for MacOS
+      id: macos-cache
+      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      with:
+        path: node_modules
+        key: ${{ env.MACOS_KEY }}
+        lookup-only: true
+        enableCrossOsArchive: true
+
+    - name: Check cache miss for Windows
+      id: windows-cache
+      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      with:
+        path: node_modules
+        key: ${{ env.WINDOWS_KEY }}
+        lookup-only: true
+        enableCrossOsArchive: true
+
+    - name: Dispatch `node_modules` prefetch for MacOS and Windows
+      id: os-matrix-prefetch
+      env:
+        MACOS_MISS: ${{ steps.macos-cache.outputs.cache-hit != 'true' && 'true' || '' }}
+        WINDOWS_MISS: ${{ steps.windows-cache.outputs.cache-hit != 'true' && 'true' || '' }}
+        PREFETCH_MAC_ONLY: '["macos-latest"]'
+        PREFETCH_WINDOWS_ONLY: '["windows-latest"]'
+        PREFETCH_BOTH: '["macos-latest", "windows-latest"]'
+        PREFETCH_FALLBACK: '["ubuntu-latest"]'
+      shell: bash
+      run: |
+        echo 'os-matrix-prefetch=${{
+          (env.OS_MATRIX_IS_FULL && env.WINDOWS_MISS && env.MACOS_MISS && env.PREFETCH_BOTH) ||
+          (env.OS_MATRIX_IS_FULL && env.MACOS_MISS && env.PREFETCH_MAC_ONLY) ||
+          (env.OS_MATRIX_IS_FULL && env.WINDOWS_MISS && env.PREFETCH_WINDOWS_ONLY) ||
+          env.PREFETCH_FALLBACK
+        }}' >> "$GITHUB_OUTPUT"

.github/actions/setup-node/action.yml

+# This is the composite action:
+#   https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+#
+# Composite actions have some limitations:
+#   - many contexts are unavailable, e.g. `runner`
+#   - `env` can be specified per-step only
+#   - if `run` is used, `shell` must be explicitly specified
+name: 'Setup Node and install dependencies'
+description: 'Setup Node and install dependencies using cache'
+inputs:
+  node-version:
+    description: 'Node version'
+    required: true
+  os:
+    description: 'Composite actions do not support `runner.os`, so it must be passed in as an input'
+    required: true
+  save-cache:
+    description: 'Save cache when needed'
+    required: false
+    default: false
+runs:
+  using: 'composite'
+  steps:
+    - name: Calculate `CACHE_KEY`
+      shell: bash
+      run: |
+        echo 'CACHE_KEY=node_modules-${{
+          inputs.os
+        }}-${{
+          inputs.node-version
+        }}-${{
+          hashFiles('yarn.lock')
+        }}' >> "$GITHUB_ENV"
+
+    - name: Restore `node_modules`
+      id: node-modules-restore
+      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      with:
+        path: node_modules
+        key: ${{ env.CACHE_KEY }}
+        enableCrossOsArchive: true
+
+    - name: Calculate `CACHE_HIT`
+      shell: bash
+      run: |
+        echo 'CACHE_HIT=${{
+          (steps.node-modules-restore.outputs.cache-hit == 'true') && 'true' || ''
+        }}' >> "$GITHUB_ENV"
+
+    - name: Setup Node
+      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: ${{ env.CACHE_HIT != 'true' && 'yarn' || '' }}
+
+    - name: Install dependencies
+      uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
+      if: env.CACHE_HIT != 'true'
+      with:
+        timeout_minutes: 10
+        max_attempts: 3
+        command: |
+          yarn install --frozen-lockfile --ignore-scripts
+          yarn prepare:re2
+
+    - name: Write `node_modules` cache
+      if: inputs.save-cache == 'true' && env.CACHE_HIT != 'true'
+      uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+      with:
+        path: node_modules
+        key: ${{ env.CACHE_KEY }}
+        enableCrossOsArchive: true
+
+    - name: Generate files
+      shell: bash
+      run: >
+        if [[ -d lib ]]; then
+          yarn prepare:generate;
+        fi
+
+    - name: Git config
+      shell: bash
+      run: |
+        git config --global core.autocrlf false
+        git config --global core.symlinks true
+        git config --global user.email 'renovate@whitesourcesoftware.com'
+        git config --global user.name  'Renovate Bot'

.github/contributing.md

@@ -14,7 +14,12 @@ If you want help with your Renovate configuration, go to the [discussions tab in
 
 ## Bug Reports and Feature Requests
 
-If you've found a **bug** or have a **feature request** then please create an issue in this repository (but search first in case a similar issue already exists).
+**Bugs**: First search for related bugs in the issues and discussions, if you don't find anything then:
+
+1. Create a [minimal reproduction](https://github.com/renovatebot/renovate/blob/main/docs/development/minimal-reproductions.md)
+1. Open a new _discussion_ and link to the minimal reproduction
+
+For **feature requests**: first search for related requests in the issues and discussions, if you don't find anything: create a _discussion_.
 
 ## Code
 
@@ -35,12 +40,13 @@ This makes it harder for us to review your work because we don't know what has c
 PRs will always be squashed by us when we merge your work.
 Commit as many times as you need in your pull request branch.
 
-If you are updating your PR branch from within the GitHub PR interface, then only use the default "Update branch" button.
+If you're updating your PR branch from within the GitHub PR interface, use the default "Update branch" button.
+This is the "Update with merge commit" option in the dropdown.
 
-Force pushing a PR is OK when:
+Force pushing a PR, or using the "Update with rebase" button is OK when you:
 
-- you need to make large changes on a PR which require a full review anyway
-- you need to bring the branch up-to-date with the target branch and incorporating the changes is more work than to create a new PR
+- make large changes on a PR which require a full review anyway
+- bring the branch up-to-date with the target branch and incorporating the changes is more work than to create a new PR
 
 ## Apply maintainer provided review suggestions
 
@@ -73,7 +79,7 @@ The codebase can be difficult to navigate, especially for a first-time contribut
 We don't want you spending an hour trying to work out something that would take us only a minute to explain.
 
 For that reason, we have a Slack channel dedicated to helping anyone who's working on or considering Pull Requests for Renovate.
-Please email rhys@arkins.net and simply mention that you need an invitation to the channel and you'll be added ASAP.
+Please email <rhys@arkins.net> and simply mention that you need an invitation to the channel and you'll be added ASAP.
 
 Important: this Slack group is restricted to development questions only in order to keep the volume of messages lower - all technical support questions should still be posted to this repository's Discussions instead.
 

.github/label-actions.yml

@@ -23,12 +23,12 @@
 
     The Renovate team
 
-'logs:problem':
+'needs-logs':
   comment: >
     Hi there,
 
 
-    We have found that there's a problem with the logs.
+    This issue or discussion is missing some logs, making it difficult or impossible to help you.
     Depending on which situation applies follow one, some or all of these instructions.
 
 
@@ -95,6 +95,12 @@
 
     </details>
 
+
+    Good luck,
+
+
+    The Renovate team
+
 'new package manager':
   comment: >
     Hi there,
@@ -133,11 +139,17 @@
 
 
     You're skipping code tests with `istanbul ignore`.
+
+
     Please only skip tests if:
       - you cannot test the code, or
       - the code is very difficult to test, or
       - the edge case won't usually happen at runtime
-    If you skip a test then always comment why:
+
+
+    If you skip a test, always comment why:
+
+
     ```ts
     // istanbul ignore next: typescript strict null check
     if (!url) {
@@ -156,7 +168,7 @@
     Hi there,
 
 
-    You are using simple `done` comments which cause a lot of noise.
+    You are using `done` comments which cause a lot of noise.
     Instead, please use GitHub's web interface to request another review.
     Please read our [contributing guidelines](https://github.com/renovatebot/renovate/blob/main/.github/contributing.md#resolve-review-comments-instead-of-commenting) to reduce noise.
 
@@ -165,3 +177,55 @@
 
 
     The Renovate team
+
+'pr:discussion-first':
+  comment: >
+    **Please create a GitHub Discussion before continuing with this PR.**
+
+
+    Thank you for your PR, but we need to discuss the requirements and implementation first.
+    This PR will be closed, but you can reopen it after the discussion has been resolved.
+
+
+    Thanks, the Renovate team
+  close: true
+
+'needs-details':
+  comment: >
+    Hi there,
+
+
+    This discussion is missing some details, making it difficult or impossible to help you.
+    Please try again to provide more details.
+
+'needs-discussion':
+  unlabel:
+    - 'type:bug'
+    - 'type:feature'
+    - 'priority-5-triage'
+    - 'status:requirements'
+  comment: >
+    **Please create a GitHub Discussion instead of this issue.**
+
+
+    We only want Renovate maintainers to create new Issues. If needed, a Renovate maintainer will create an Issue after your Discussion been triaged and confirmed. As a Renovate user, please create a GitHub Discussion in this repo instead.
+
+
+    This Issue will now be closed and locked. We may later batch-delete this issue. This way we keep Issues actionable, and free of duplicates or wrong bug reports.
+
+
+    Thanks, the Renovate team
+  close: true
+  close-reason: 'not planned'
+  lock: true
+  lock-reason: 'resolved'
+
+'format-code-comments':
+  comment: >
+    Hi, please format any copy/pasted code or logs so they're readable.
+
+
+    You can find a Markdown code formatting guide [here](https://www.markdownguide.org/basic-syntax/#code) as well as some GitHub-specific information formatting code blocks [here](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks).
+
+
+    Thanks, the Renovate team

.github/workflows/codeql-analysis.yml

-name: 'Code scanning - action'
+name: 'Code scanning'
 
 on:
   push:
     branches: [main]
+
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [main]
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+
   schedule:
     - cron: '0 13 * * 1'
 
@@ -19,10 +26,10 @@ permissions:
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
-
+    if: github.event.pull_request.draft != true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
       - name: Delete fixtures to suppress false positives
         run: |
@@ -30,7 +37,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5
+        uses: github/codeql-action/init@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
         with:
           languages: javascript
 
@@ -40,7 +47,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5
+        uses: github/codeql-action/autobuild@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -54,4 +61,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5
+        uses: github/codeql-action/analyze@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1

.github/workflows/dependency-review.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@c090f4e553673e6e505ea70d6a95362ee12adb94 # v3.0.3
+        uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6

.github/workflows/devcontainer.yml

+name: Devcontainer
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+
+jobs:
+  devcontainer-test:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft != true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Build and run dev container task
+        uses: devcontainers/ci@57eaf0c9b518a76872bc429cdceefd65a912309b # v0.3.1900000329
+        with:
+          runCmd: yarn build